Privacy Policy

Last updated: 21 July 2026

Who we are

Planatom is a service operated by C8VA Limited, a UK-based technology company that gathers, interprets and republishes publicly available planning application data from local authority websites. Our mission is to make planning information clearer and more accessible so that communities can engage meaningfully with local development. C8VA Limited is the data controller for the processing described in this policy. You can contact us at [email protected].

What we do

We collect planning application records already in the public domain. We clean, structure and enrich that information using artificial-intelligence (AI) techniques such as natural-language processing, tagging and geocoding. We then publish the enriched data on our websites so the public can search, filter and understand planning activity more easily than on council portals.

Data we process from public sources

We do not intentionally collect phone numbers, email addresses or other contact details from source material. If they appear in it, we attempt to redact them automatically.

Data you give us (accounts)

You can use Planatom without an account. If you create one, we process:

• Account details — your email address and a password (stored only as a secure hash, never in plain text). We use your email address to sign you in and to send the emails described below.
• Your address, if you choose to provide it — nearby notifications are an optional feature that alerts you to planning applications within a radius of an address you give us. To provide it we store the address and convert it to geographic coordinates (geocoding). Providing an address is entirely optional; you can remove it, or turn nearby notifications off, at any time from your notification settings, and we then stop this processing.
• Follows and preferences — the applications you like/follow and your notification settings, so we can send you the updates you asked for (for example when a decision is issued on an application you follow).
• Sign-in records — when you sign in we record the session together with your IP address and browser identifier (user agent) for security purposes, such as detecting suspicious access and abuse.
• Emails — we send transactional email only: password resets, decision updates for applications you follow, and nearby-application alerts you have enabled. We do not send marketing email.

Legal bases for processing

Under UK GDPR and the Data Protection Act 2018, we rely on the following bases for the processing described in this policy:

• Republishing and enriching public planning data — legitimate interests (Article 6(1)(f)). Planning applications are published because the law requires it: local planning authorities must keep a public register of applications and decisions and must publicise applications so that anyone can inspect and comment on them. Our legitimate interest — shared with the public at large — is in making that statutory public record genuinely accessible: searchable, legible and comparable across authorities, in support of the transparency and public participation the publication regime exists to achieve. We have balanced this against the privacy impact on the individuals named, which is limited because the same information is already required by law to be open to public inspection; because we add no contact details and attempt to redact any that appear; and because we operate the redaction and objection process described under “Your rights” below. To the extent that republication of the statutory planning register also constitutes a task carried out in the public interest, we rely additionally on Article 6(1)(e).
• Providing your account — contract (Article 6(1)(b)). Processing your email address, password hash, follows and notification preferences is necessary to provide the account and features you have signed up for.
• Nearby notifications — consent (Article 6(1)(a)). We only process your address and its coordinates because you chose to provide them for this feature. You can withdraw consent at any time by removing the address or disabling nearby notifications.
• Security and service integrity — legitimate interests (Article 6(1)(f)). Recording IP addresses and technical logs to authenticate sessions, rate-limit abuse and keep the service secure.

How we use AI

• Large-language-model classifiers apply consistent category tags.
• Entity extraction (streets, postcodes, decision dates) improves search accuracy.
• Plain-English summaries are generated for complex proposals.

AI output is reviewable and can be corrected. No automated decision made by Planatom produces legal or similarly significant effects on any individual.

Cookies and analytics

We use cookies and similar technologies (including local storage) for essential functionality and to understand how the service is used.

What analytics collects

We use PostHog to measure page views, clicks and session activity. Typed form values are masked and are not captured. For visitors without an account, analytics is pseudonymous: events are linked to a random device identifier, not to you. If you sign in, we link your analytics events to your account using a random account identifier together with your email address, so we can understand how account features are used and support you better. We do not use analytics data for advertising, and we do not track you across other websites.

You can control or delete cookies in your browser settings; blocking the essential cookie will prevent signing in.

Service providers and international transfers

We share data only with the providers that run the service:

• DigitalOcean — cloud hosting for the application and database.
• Cloudflare — content delivery, security and bot protection; handles site traffic including IP addresses.
• Postmark — delivery of the transactional emails described above.
• PostHog — analytics, as described above.

Pages that display a map load map imagery from Carto’s content delivery network; as with any embedded content, your browser discloses your IP address to that provider when the map loads.

Some of these providers process data outside the UK. Where they do, transfers are safeguarded by UK adequacy regulations or the UK International Data Transfer Agreement/Addendum incorporating Standard Contractual Clauses. We never sell personal data.

Advertising and sponsorship

We do not currently show third-party advertising. If we introduce sponsorship, it will be contextual — based on the page or council area being viewed, not on personal data — and we do not share personal data with sponsors or advertisers. If that ever changes, we will update this policy first and seek consent where the law requires it.

Data retention

• Planning records form part of the public historical record, so we retain them indefinitely unless the source authority removes or corrects the record, or we uphold an erasure or redaction request.
• Account data is retained while your account is active and deleted when your account is deleted.
• Sign-in session records and security logs are retained for up to 12 months.
• If you remove your address or disable nearby notifications, we delete the stored address and coordinates.

Your rights

• Access — request a copy of the personal data we hold about you.
• Rectify — ask us to correct inaccurate data.
• Erase / redact — request removal or anonymisation of personal data.
• Restrict — ask us to pause processing while a dispute is resolved.
• Object — object to processing based on legitimate-interest or public-interest grounds.
• Withdraw consent — for consent-based features such as nearby notifications, at any time.
• Complain — lodge a complaint with the UK Information Commissioner’s Office (ICO).

Because planning data is published under a statutory transparency regime, we may decline to remove information essential to understanding an application (for example, the site address). We will, however, routinely redact names and reduce addresses to the outward postcode (for example, “SK10”) when a valid request is received.

How to make a data request

Use our Data Requests form and include:

• the planning application reference or page URL (if your request concerns one);
• the personal data you want accessed, corrected, removed or anonymised;
• your connection to the data (for example applicant, agent or case officer) — we may ask for proof of identity before acting.

We aim to respond within one calendar month. If we refuse a request, we will explain why and set out your right to complain to the ICO.

Children

Our service is not aimed at children and we do not knowingly process children’s personal data.

Changes to this policy

We may update this Privacy Policy to reflect changes in law or our practices. We will post the revised version here and, where appropriate, notify registered users.

Contact

Questions about this policy or your data should be emailed to [email protected].